InfoSecBulletin Cybersecurity for mankind
CERT Polska has alerted that bad actors are actively exploiting a security flaw in Zimbra Collaboration Suite to execute code remotely. The bug known as CVE-2026-73570 lets attackers who are not logged in run any commands on affected servers as the zimbra user.
There is a flaw with Zimbra’s SNMP monitoring feature. It has a flaw that allows OS command injection. This affects setups that have the zimbra-snmp package on, SNMP notifications turned on with the snmp_notify setting, and the swatchdog service active.
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Swatchdog is enabled by default, increasing the exposure risk for organizations that have enabled SNMP trap notifications.
Zimbra RCE Vulnerability Exploited
An attacker can send special SMTP requests to take advantage of improper sanitization during SNMP notifications. They do not need to log in first, and this can lead to running any shell command with the rights of the Zimbra account.
This access could let attackers set up web shells, steal email data, change server settings, stay hidden, or use the hacked mail server to attack more.
Zimbra fixed CVE-2026-73570 in version 10.1.20, which came out on July 20, 2026. The security notice from the vendor says that the update solves a command injection issue in the SNMP monitoring part when notifications are turned on.
Organizations using older versions should see this issue as a top priority for fixing because attacks have already been seen in real situations. CERT Polska has also shared advice on how to detect if a system has been compromised.
Administrators need to check /var/log/zimbra.log for strange service-status messages. These messages could show an unknown or bad payload that goes from stopped to running, or from running to stopped.
Such activity may show that a hacker has misused the weak notification system to start or stop processes they control. Security teams need to check files made by the Zimbra user in the last 30 days. The key folders to look at are /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/.
Unexpected JSP files, running scripts, zipped files, or recently changed application content in these places may show payload staging or staying power.
Organizations need to quickly find all Zimbra Collaboration Suite servers. They must check if SNMP notifications are on and upgrade any weak systems to version 10.1.20 or a newer fixed version.
Administrators should disable unnecessary SNMP notifications and watch SMTP activity, Zimbra logs, process creation, and file changes involving the zimbra account if emergency patching can’t be done right away.
Any signs of misuse should be seen as a possible problem with the mail server. Admins should keep logs, isolate affected computers if needed, change passwords, check mailbox access, and carry out a complete investigation into the incident.
